- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 2 days
The published process acknowledges within two business days and assigns CVEs through Red Hat Product Security.
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://gitlab.gnome.org/GNOME/gnome-shell
Products and areas 12
- Clipboard, primary selection and drag-and-drop as the compositor arbitrates them between clients
- GNOME's security process publishes no component scope list. It takes a private report on any GNOME project through a single form, so both trees below are inside it and nothing narrower is carved out
- Input handling end to end through Clutter and libinput: keyboard grabs, pointer and touch routing, keybinding dispatch and the special-key path that reaches the shell before any application
- Monitor configuration, output handling and the display-management interfaces
- Mutter as an X11 window manager and its Xwayland integration, covering window property handling, selections, override-redirect windows and the X client boundary
- Mutter as a Wayland compositor: protocol object lifetimes, surface and subsurface handling, buffer management and every Wayland protocol extension it implements
- Screen capture, screencast and remote-desktop interfaces, including the portal-facing surface and what an application is allowed to record
- The D-Bus interfaces both projects expose on the session bus and what an unprivileged client can drive through them
- The GNOME Shell JavaScript layer and the GJS boundary, including the extension API, extension installation and the privileges an installed extension inherits
- The lock screen and screen shield in full: the unlock dialogue, the authentication prompt, the notification and media controls exposed while locked, and every transition into and out of the locked state
- The search provider mechanism, the notification path and the on-screen keyboard, all of which render content from other applications
- The session and login handling GNOME Shell performs, including the greeter mode it runs in for GDM and the switch-user path
Out of scope (6)
- Attacks that require the attacker to already be running code as the logged-in user, unless the finding crosses out of that user's boundary
- Distribution packaging and distro-specific patches rather than upstream gnome-shell or mutter
- GDM's own greeter process and PAM handling, which is a separate project with its own entry
- GTK, GLib, gdk-pixbuf, pango and other libraries beneath the shell; some of those ship in ChromeOS and are paid there
- Third-party GNOME Shell extensions, which are not part of either tree. An extension that grants itself privilege is that extension's defect
- Xwayland internals, which share the xserver repository with the X.Org Server and are reachable through the ChromeOS VRP as x11-base/xwayland
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
File through the report form at security.gnome.org. It opens a confidential issue on gitlab.gnome.org routed to the security team, and it is the documented private channel
-
Do not open an ordinary GitLab issue. A normal issue on gitlab.gnome.org is world-readable the moment it is filed
-
GitHub private vulnerability reporting is disabled on the GNOME mirrors, so the advisory button there is not a route into this process
-
Say which repository the defect lives in. gnome-shell and mutter are separate trees and a lock-screen finding frequently crosses both
-
State the session type. Wayland and X11 take genuinely different paths through Mutter and a bug in one often does not exist in the other
-
For a lock-screen finding, record the exact timing and input sequence. This class is reproducible but order-sensitive, and a report the triager cannot repeat goes nowhere
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-102559 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102560 | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102555 | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when | High 8.2 | 29 Sep 2026 |
| CVE-2026-102558 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102557 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102556 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong. | High 8.6 | 29 Sep 2026 |
| CVE-2026-66337 | A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory. | Medium 6.5 | 24 Jul 2026 |
| CVE-2026-66338 | A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests. | Medium 5.4 | 24 Jul 2026 |
| CVE-2026-66339 | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure. | Medium 6.5 | 24 Jul 2026 |
| CVE-2026-12548 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents. | Medium 4.2 | 21 Jul 2026 |
| CVE-2026-58014 | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. | High 7.3 | 30 Jun 2026 |
| CVE-2026-58015 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a | Medium 5.9 | 30 Jun 2026 |
| CVE-2026-58016 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of s | High 7.5 | 30 Jun 2026 |
| CVE-2026-58010 | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-58011 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service. | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-58012 | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 b | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-58013 | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-13601 | A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML in | High 7.1 | 29 Jun 2026 |
| CVE-2026-12549 | The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding. | Medium 4.8 | 22 Jun 2026 |
| CVE-2026-1766 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which caus | Medium 5.6 | 16 Jun 2026 |
| CVE-2026-1767 | A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentiall | Medium 5.6 | 16 Jun 2026 |
| CVE-2026-1764 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it co | Medium 5.6 | 16 Jun 2026 |
| CVE-2026-2708 | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values. | Low 3.7 | 23 Apr 2026 |
| CVE-2026-5201 | A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of servi | High 7.5 | 31 Mar 2026 |
| CVE-2026-5119 | A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation. | Medium 5.9 | 30 Mar 2026 |
| CVE-2026-2436 | A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service. | Medium 6.5 | 26 Mar 2026 |
| CVE-2026-2369 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service. | Medium 6.5 | 19 Mar 2026 |
| CVE-2026-4271 | A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application inst | Medium 5.3 | 17 Mar 2026 |
| CVE-2026-3633 | A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection. | Low 3.9 | 17 Mar 2026 |
| CVE-2026-3634 | A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks | Low 3.9 | 17 Mar 2026 |
| CVE-2026-3632 | A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could | Low 3.9 | 17 Mar 2026 |
| CVE-2026-3099 | A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain u | Medium 5.8 | 12 Mar 2026 |
| CVE-2026-2443 | A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a ser | Medium 5.3 | 13 Feb 2026 |
| CVE-2026-1801 | A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or | Medium 5.3 | 3 Feb 2026 |
| CVE-2026-1536 | A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitti | Medium 5.8 | 28 Jan 2026 |
| CVE-2026-1539 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications usin | Medium 5.8 | 28 Jan 2026 |
| CVE-2026-1467 | A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or | Medium 5.8 | 27 Jan 2026 |
| CVE-2025-14512 | A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values. | Medium 6.5 | 11 Dec 2025 |
| CVE-2025-14087 | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings. | Medium 5.6 | 10 Dec 2025 |
| CVE-2025-13601 | A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. | High 7.7 | 26 Nov 2025 |
| CVE-2025-4056 | A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines. | High 7.5 | 28 Jul 2025 |
| CVE-2025-6196 | A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote a | Medium 5.5 | 17 Jun 2025 |
| CVE-2025-6199 | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed ima | Low 3.3 | 17 Jun 2025 |
| CVE-2025-6052 | A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption. | Low 3.7 | 13 Jun 2025 |
| CVE-2023-5616 | In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user. | Medium 4.9 | 15 Apr 2025 |
| CVE-2025-3155 | A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. | High 7.4 | 3 Apr 2025 |
| CVE-2025-2784 | A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. | High 7.0 | 3 Apr 2025 |
| CVE-2022-1736 | Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default. | Critical 9.8 | 31 Jan 2025 |
| CVE-2023-43091 | A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code. | Critical 9.8 | 17 Nov 2024 |
| CVE-2024-52533 | gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character. | Critical 9.8 | 11 Nov 2024 |
| CVE-2024-52530 | GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. | High 7.5 | 11 Nov 2024 |
| CVE-2024-52531 | GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a request or response). | Medium 6.5 | 11 Nov 2024 |
| CVE-2024-52532 | GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. | High 7.5 | 11 Nov 2024 |
| CVE-2024-42415 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to tri | High 8.4 | 3 Oct 2024 |
| CVE-2024-36474 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. | High 8.4 | 3 Oct 2024 |
| CVE-2024-34397 | An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to th | Medium 5.2 | 7 May 2024 |
| CVE-2020-36774 | plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). | Medium 5.5 | 19 Feb 2024 |
| CVE-2022-48622 | In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c. | High 7.8 | 26 Jan 2024 |
| CVE-2023-5557 | A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability. | High 7.5 | 13 Oct 2023 |
| CVE-2023-43090 | A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool. | Medium 5.5 | 22 Sep 2023 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview GNOME Shell is the desktop shell on the Ubuntu, Fedora, RHEL and Debian defaults, and Mutter is the compositor beneath it, acting as the Wayland compositor and the X11 window manager at once. Between them they own the lock screen, the input path and every pixel on the display. The class worth naming is lock-screen bypass: a way to reach a live session on a machine the owner believed was locked, and GNOME Shell has produced more than one. It costs almost nothing to demonstrate and earns nothing to report, because GNOME's bug bounty is defunct and this part of the stack was never inside it. sorona.xyz pays you directly on qualified, reproduced findings. In scope GNOME's security process publishes no component scope list. It takes a private report on any GNOME project through a single form, so both trees below are inside it and nothing narrower is carved out The lock screen and screen shield in full: the unlock dialogue, the authentication prompt, the notification and media controls exposed while locked, and every transition into and out of the locked state The session and login handling GNOME Shell performs, including the greeter mode it runs in for GDM and the switch-user path Mutter as a Wayland compositor: protocol object lifetimes, surface and subsurface handling, buffer management and every Wayland protocol extension it implements Mutter as an X11 window manager and its Xwayland integration, covering window property handling, selections, override-redirect windows and the X client boundary Input handling end to end through Clutter and libinput: keyboard grabs, pointer and touch routing, keybinding dispatch and the special-key path that reaches the shell before any application Screen capture, screencast and remote-desktop interfaces, including the portal-facing surface and what an application is allowed to record Clipboard, primary selection and drag-and-drop as the compositor arbitrates them between clients The GNOME Shell JavaScript layer and the GJS boundary, including the extension API, extension installation and the privileges an installed extension inherits The D-Bus interfaces both projects expose on the session bus and what an unprivileged client can drive through them The search provider mechanism, the notification path and the on-screen keyboard, all of which render content from other applications Monitor configuration, output handling and the display-management interfaces Out of scope GDM's own greeter process and PAM handling, which is a separate project with its own entry GTK, GLib, gdk-pixbuf, pango and other libraries beneath the shell; some of those ship in ChromeOS and are paid there Xwayland internals, which share the xserver repository with the X.Org Server and are reachable through the ChromeOS VRP as x11-base/xwayland Third-party GNOME Shell extensions, which are not part of either tree. An extension that grants itself privilege is that extension's defect Attacks that require the attacker to already be running code as the logged-in user, unless the finding crosses out of that user's boundary Distribution packaging and distro-specific patches rather than upstream gnome-shell or mutter Most-valued findings Lock-screen bypass in any form: reaching the live session, reading its content or driving input into it from a locked machine. This is the flagship class here and GNOME Shell has a history of it Anything reachable from the greeter, where GNOME Shell runs before a user has authenticated at all Input routing defects that deliver keystrokes to the wrong client, defeat a keyboard grab or let one client capture another client's input on a Wayland session where the compositor is the only thing enforcing that separation Screen capture or screencast paths that let an application record the display without the user granting it, since the compositor is the enforcement point for that permission Clipboard and selection handling that leaks one client's data to another, particularly across the locked and unlocked boundary Wayland protocol handling defects in Mutter that a hostile client can drive: object lifetime confusion, buffer handling and use-after-free in surface management Extension API and GJS boundary flaws that let ordinary web-delivered content or an unprivileged process reach shell-privileged JavaScript Session D-Bus interfaces that accept an action from a client that should not be allowed to request it, especially anything touching session locking, unlocking or logout Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. File through the report form at security.gnome.org. It opens a confidential issue on gitlab.gnome.org routed to the security team, and it is the documented private channel Do not open an ordinary GitLab issue. A normal issue on gitlab.gnome.org is world-readable the moment it is filed GitHub private vulnerability reporting is disabled on the GNOME mirrors, so the advisory button there is not a route into this process Say which repository the defect lives in. gnome-shell and mutter are separate trees and a lock-screen finding frequently crosses both State the session type. Wayland and X11 take genuinely different paths through Mutter and a bug in one often does not exist in the other For a lock-screen finding, record the exact timing and input sequence. This class is reproducible but order-sensitive, and a report the triager cannot repeat goes nowhere There is no money at any stage. The GNOME bounty that once ran on YesWeHack is gone, and its scope only ever covered GLib and libsoup Disclosure Report through the security.gnome.org form, which opens a confidential issue visible to a small security team on gitlab.gnome.org. The published process acknowledges within two business days and assigns CVEs through Red Hat Product Security. Confidentiality runs until a fix is committed to the git repository or ninety days pass, whichever comes first, so plan the embargo against that clock rather than a release date. Fixes reach users through distribution backports, and the enterprise distributions move on their own schedule after that. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability